Privacy Policy
Last update: 2026-06-10 Version: 2.0
BEFORE ACCESSING THIS SITE PLEASE READ CAREFULLY THE TERMS AND CONDITIONS, PRIVACY POLICY AND COOKIE POLICY. Users who do not accept these conditions are asked to leave the Site immediately.
This Privacy Policy is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Legislative Decree 196/2003, as amended ("Privacy Code"), to those who interact with the services offered by the Data Controller through https://face-harmony.com (the "Site"), the Face Harmony DV App, the platforms connected to the Data Controller’s services and the Data Controller’s social media channels.
This Policy describes — transparently, concisely and accessibly — how Face Harmony DV S.r.l. collects, uses, stores and protects the personal data of Data Subjects, the rights granted to Data Subjects under European legislation and how to exercise them. It enables Data Subjects to provide their personal data knowingly and on an informed basis, in accordance with the GDPR principle of transparency.
The User is invited to read this document carefully before sending any personal data via the forms on the Site.
Essential definitions
Data subject: the natural person whose personal data is processed.
Personal data: any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more elements specific to his or her physical identity.
Processing: any operation carried out on personal data (collection, recording, storage, consultation, communication, cancellation, etc.).
Data controller: the person who determines the purposes and means of the processing (see §1).
Data Controller: the person who processes personal data on behalf of the Data Controller pursuant to a DPA (see §5).
1 · Data controller
The data controller of personal data is:
FACE HARMONY DV S.R.L.
Registered office: Corso Magenta 74, 20123 Milan (MI), Italy
VAT number / Fiscal Code: 13405460968
REA: MI-2720884 (CCIAA Milan Monza Brianza Lodi)
Share capital: €10,000.00, fully paid
ATECO: 85.59.2 (professional training)
Establishment date: 02/16/2024
PEC: faceharmonydv@legalmail.it
Email: dv@face-harmony.com
Data Protection Officer (DPO/RPD): not designated - the processing carried out by the Data Controller does not fall within the cases of mandatory appointment provided for by the art. 37 GDPR (absence of large-scale processing of special categories of data, absence of regular and systematic monitoring of data subjects on a large scale, and failure to exercise public authority functions). To exercise the GDPR rights (Articles 15-22) or for any question relating to the protection of personal data, the data subject can contact the Data Controller directly at the contact details indicated above. This designation will be reevaluated upon the occurrence of any of the conditions referred to in the art. 37 par. 1 GDPR.
Scope of application: this Policy applies to the processing carried out by the Data Controller via the Site (face-harmony.com and related subdomains), the Face Harmony DV App, the platforms connected to the services provided by the Data Controller (for example: the Academy's LMS platform and the videoconferencing platforms used for consultancy) and the Data Controller's social channels. The external pages and properties managed by the Data Controller on third-party platforms refer to this Policy, which constitutes the Data Controller's reference privacy document.
Data subjects
Users of the Site and the Data Controller's social channels and/or platforms connected to the services provided by the Data Controller, Buyers, Potential Customers, Collaborators.
2 · Categories of personal data processed
2.1 Categories of data collected
Data sent by users via e-mail or through the online forms of the Site and/or connected platforms and/or via telephone and/or during the purchase of services: in particular common data such as e-mail address, name, surname, telephone, personal data, location, address, contact details, tax code and VAT number, data relating to payment methods where the payment is managed by the Data Controller. Data provided during the management of the relationship via the Site and/or telephone and/or social channels and/or connected platforms.
Contact form (ContactForm — page /it/contact ): name, surname, email, telephone (optional), subject of the message, content of the message.
Demo request form (DemoFormSection — homepage): name, email, company, telephone, professional role.
Typeform B2B form (external link recalled from CTA homepage and services pages): name, email, company, B2B qualification data collected directly by Typeform S.L. according to its own information.
Data collected automatically by the systems responsible for the operation of the Site and/or social channels and/or platforms: navigation data and data relating to the device, such as IP address, domain names, time of the request, country of origin, duration of the visit, page views and navigation paths, browser type, device type and operating system; server logs (collected automatically by hosting); technical anti-bot signals and IP hashes for rate-limiting purposes (see the Managers indicated in §5).
Data relating to cookies: information relating to cookies is available in the Cookie Policy (see §6).
Common data relating to images and/or video-audio relating to a natural person, subject to obtaining the relevant consent.
Biometric data relating to representative images of the face of a natural person subjected to automated processing, after obtaining the consent of the data subject.
Personal data relating to the health of a natural person, with reference to data that may reveal information relating to the state of health, with the exclusion of information relating to pathologies or illnesses and limited to the data necessary and relevant for the purposes indicated in this document.
The Site does not require registration, does not use user logins and does not process online payments; the reserved areas and payments relating to the Services are managed through the connected platforms and payment providers indicated in §5.
2.2 Data Sources and Third Party Data
The personal data processed comes from two distinct sources: data provided voluntarily by the User (form, email, telephone, social channels, registration for webinars and similar operations) and data collected automatically by the systems responsible for the functioning of the Site and platforms.
If personal data of third parties are shared with the Data Controller, broad indemnity is granted with respect to any dispute, claim and request for compensation for damage that may reach the Data Controller from people whose personal data have been shared in violation of the applicable rules on the protection of personal data.
2.3 Processing methods
The processing of personal data is carried out using paper-based methods and IT tools, in compliance with the provisions regarding the protection of personal data and, in particular, the appropriate technical and organizational measures referred to in art. 32, par. 1, GDPR to guarantee integrity, confidentiality and availability of the personal data processed (see §10). Automated tools, including artificial intelligence tools, may also be adopted, as specified in this Policy and in the Cookie Policy. The technical-IT data collected to allow the functioning of the Site may be processed for the sole purpose of obtaining anonymous statistical information on the use of the Site and/or to check its correct functioning. The personal data that the data subject chooses to provide will be processed in compliance with the conditions of lawfulness pursuant to Articles 6 and 9 GDPR, with anonymization and pseudonymization tools where indicated. The recipients of the data are indicated in §5.
2.4 Data of minors - Services reserved for adults
The Data Controller's Services are reserved for adults (18+). The Data Controller does not knowingly collect personal data from minors. If the Data Controller detects that personal data of a minor has been collected, it will delete them without unjustified delay. Parents and guardians who believe that a minor has provided data to the Data Controller are invited to contact the contact details indicated in §1.
3 · Purposes of processing, legal bases and retention criteria
The data collected are processed for the purposes indicated below, each with its own legal basis and its own retention criteria.
Execution of pre-contractual measures
By way of example: allow users to use the Site, purchase services through the registration procedure aimed at purchasing and paying, receive responses relating to the use of the Site or the services, receive informative communications, be contacted, book a call, register for free for the Data Controller's webinars, fill in the contact form. This purpose allows the Data Controller to provide assistance and reach the conclusion of the distance selling contract.
LEGAL BASIS: art. 6, par. 1, point b) GDPR (execution of pre-contractual measures adopted at the request of the data subject). RETENTION CRITERIA: for the time necessary to follow up on the data subject's request and in any case no longer than the definition of the pre-contractual relationship.
Execution of the contract
Allow the carrying out of operations strictly connected and instrumental to the correct management of contractual relationships with Users and Buyers within the scope of the Service provided and the direct sale of the Service, for example to process purchase orders, issue invoices and receipts. This includes the activities necessary for the activation of accounts for the use of the Service, the registration and qualification of the User, the management and updating of related information, as well as the acceptance and management of questions and/or requests received at the contact details provided by the Data Controller. Failure to provide the data requested for this purpose, or the proven incorrectness of the data provided, could make it impossible to successfully conclude the contract.
LEGAL BASIS: art. 6, par. 1, point b) GDPR (contract). RETENTION CRITERIA: the data will be kept for the time necessary to meet the obligations undertaken.
Direct marketing
The Data Controller may forward to the user e-mails and newsletters containing news, information, promotional, commercial and advertising communications or news relating to new Services sold or new features of the Site or relating to new initiatives or market research or other information material. Marketing campaigns can take place via e-mail, SMS, instant messaging tools, telephone, social channels and communities, with both automated and traditional contact methods. The Data Controller may use advertising tracking tools provided by third parties (for example, the pixel provided by Facebook/Meta) to monitor the conversions of advertising campaigns, show personalized ads and create audience groups to which to target the campaigns; this Policy is stored and analyzed by the third party and possibly used for its own advertising purposes. It is possible to refuse consent to tracking through the cookie banner (see §6).
LEGAL BASIS: art. 6, par. 1, point a) GDPR (consent). RETENTION CRITERIA: until consent is revoked and in any case for a period not exceeding 24 months from collection, without prejudice to the renewal of consent. The user can revoke consent by clicking on the link in the advertising emails or by requesting cancellation from the Data Controller. Failure to provide consent has no consequence on the provision of services. The data subject can revoke the consent even partially, for example by consenting only to traditional contact methods.
Soft Spam (art. 130, paragraph 4, Privacy Code)
The personal data will also be processed to allow the Data Controller to send by email to the data subject who has already purchased a service commercial and promotional communications regarding services similar to those being sold, without the need for express and prior consent from the data subject, as required by art. 130, paragraph 4, Privacy Code (as amended by Legislative Decree 101/2018), provided that the data subject does not exercise the right of opposition. In compliance with the art. 13, paragraph 2, of Directive 2009/136/EC and Recital 47 of Regulation (EU) 2016/679, the Data Controller may use the user's e-mail address, acquired in the context of a customer relationship, to send electronic communications concerning products or services similar to those previously offered.
LEGAL BASIS: art. 6, par. 1, point f) GDPR (legitimate interest of the Data Controller). RETENTION CRITERIA: until the data subject objects, which can be exercised free of charge at any time, including via the opt-out link within the commercial communication.
Profiling
The data will be processed for the analysis and evaluation of interests, habits and consumption choices, including the creation of profiles, in order to be able to send personalized information and promotional material on the Services offered by the Data Controller. Profiling will also be possible through automated processing (for example third-party advertising pixels accompanied by email marketing campaigns).
LEGAL BASIS: art. 6, par. 1, point a) GDPR (consent). RETENTION CRITERIA: storage will not exceed 12 months from collection, unless express consent is given again.
Sending newsletters
By registering for the newsletter, the User's email address is automatically added to a contact list to which email messages containing information, including commercial and promotional information, relating to Face Harmony DV may be sent. Your email address may also be added to this list as a result of registration after making a purchase.
LEGAL BASIS: art. 6, par. 1, point a) GDPR (consent). RETENTION CRITERIA: until consent is revoked, by clicking on the link in all advertising emails to unsubscribe or by sending an email to the Data Controller.
Direct marketing via WhatsApp Business (art. 130 Privacy Code)
In the Site modules (ContactForm and DemoFormSection) there is a dedicated, distinct and not pre-ticked checkbox, through which the User can explicitly consent to being contacted via WhatsApp Business for direct marketing purposes (commercial offers, promotional communications, sales follow-up). This consent:
it is optional (failure to provide it does not affect the possibility of completing the form and receiving a response to the main request);
it can be revoked at any time by writing to the Data Controller at the contact details indicated in §1 or by blocking the Data Controller's number from the WhatsApp app;
it is registered on the server side together with the form payload, for the purposes of proving consent pursuant to art. 7, par. 1 GDPR;
is applied exclusively by Face Harmony DV S.r.l. operators. authorized for processing.
LEGAL BASIS: art. 6, par. 1, point a) GDPR (consent) + art. 130 Privacy Code. RETENTION CRITERIA: until consent is revoked.
Use of cookies
LEGAL BASIS and RETENTION CRITERIA: please refer to the Cookie Policy available on the Site (see §6).
Networking
The Data Controller may process personal contact data to connect Users through the Face Harmony DV Community managed by the Data Controller.
LEGAL BASIS: art. 6, par. 1, point a) GDPR (consent). RETENTION CRITERIA: until consent is revoked.
Security
To identify and prevent illicit behavior and/or abuse in the use of the Site and to obtain information necessary to identify anomalies, fraudulent activities and/or abuse in the use of the Site and the Services provided (for example: anti-bot protection of the forms and limitation of the frequency of requests; see §5 and §10).
LEGAL BASIS: art. 6, par. 1, point f) GDPR (legitimate interest of the Data Controller). RETENTION CRITERIA: personal data will be stored until the legitimate interest of the Data Controller in preventing illicit behavior and/or abuse is satisfied, limited to what is necessary to pursue the purpose.
Demonstration purposes
To offer consultancy within the Face Harmony DV Method and to carry out practical simulations of facial harmonization through the provision of representative images of the face (common personal data, health-related data and biometric data), after obtaining specific and informed consent and subsequent anonymisation or pseudonymisation of personal data.
The simulations may also take place through the use of automated processing and artificial intelligence technologies, through the intervention of a Face Harmony DV Consultant who guides the information processing process, limiting itself to that strictly necessary for the purpose pursued.
The demonstrations will be carried out in order to make simulations to represent the Face Harmony DV method in the context of the consultancy services provided by the Supplier, after obtaining the consent of the data subject in a specific and informed form and subsequent anonymisation or pseudonymisation of the personal data.
LEGAL BASIS: consent, art. 9, par. 2, point a) GDPR. RETENTION CRITERIA: the special category data will be deleted at the end of the demonstration, unless the data subject consents on the same legal basis to carry out further simulations and in any case no later than 12 months from the consent given. The right of revocation can be expressed at any time without prejudice to the lawfulness of the processing based on the consent given before the revocation.
Recording of meetings and audio/video/image recordings and dissemination
The Data Controller may process personal data relating to participation in presence and/or remotely (common data), with particular reference to the recording and/or filming of audio-video-images of the Beauty Classes, to improve the service provided and/or for information purposes and/or for dissemination for promotional purposes, with the prior consent of the data subject, through publication on the Site, on social media (by way of example Instagram, Facebook), via YouTube or other communication channels.
LEGAL BASIS: art. 6, par. 1, point a) GDPR (consent). RETENTION CRITERIA: until consent is revoked and in any case no longer than 24 months. The right of revocation can be expressed at any time without prejudice to the lawfulness of the processing based on the consent given before the revocation.
Statistical purpose
In order to monitor the use of the Site and/or social channels and/or connected platforms through visit analysis tools in aggregate and anonymous form, to improve the quality of services and performance. For this purpose, the Site uses cookie-free aggregate analytics: the traffic metrics are collected in aggregate and anonymous form, without individual profiling and without the installation of analytical cookies, and therefore without the need for consent pursuant to art. 122 Privacy Code.
LEGAL BASIS: art. 6, par. 1, point f) GDPR (legitimate interest of the Data Controller) - no profiling. RETENTION CRITERIA: the data is processed in aggregate and anonymous form; any personal data instrumental to the collection are kept only for the technical processing time.
Administrative, accounting, fiscal purposes and legal obligations
This type of processing may include document retention for the periods required by law, in particular with respect to accounting records, purchase orders and more generally to contractual documentation. The provision of personal data and the related processing for purposes attributable to legal obligations are necessary to be able to fulfill the obligations placed on the Data Controller, which may include the conservation and communication of personal data to the competent authorities.
LEGAL BASIS: art. 6, par. 1, point c) GDPR (legal obligation). RETENTION CRITERIA: for the period established by the applicable mandatory law (for example, 10 years for accounting records pursuant to art. 2220 of the Civil Code).
Exercise and protection of a right in legal proceedings
The Data Controller may process personal data to exercise a legal right and to fulfill any regulatory obligations to which it is subject, including tax and accounting legislation.
LEGAL BASIS: art. 6, par. 1, point f) GDPR (legitimate interest). RETENTION CRITERIA: until the legitimate interest of the Data Controller is satisfied, limited to what is necessary to pursue the purpose and until the dispute is resolved.
Information communications on webinars
The Data Controller may process personal data to communicate, by SMS, instant messaging or email, information regarding the webinars for which the data subject has registered, such as start day and time, and to send a reminder before the start of the webinar with the access link.
LEGAL BASIS: art. 6, par. 1, point a) GDPR (consent). RETENTION CRITERIA: until consent is revoked and in any case no later than 12 months from the consent given, unless new and express consent is issued.
Customer Satisfaction
The data will be processed to send surveys and tests to verify the level of customer satisfaction, in order to improve the offer of the owner's services, without marketing purposes.
LEGAL BASIS: art. 6, par. 1, point f) GDPR (legitimate interest of the Data Controller). RETENTION CRITERIA: until the data subject objects.
Issuance of a certificate
The data may be processed for the issue of a certificate of participation in the Face Harmony DV Academy.
LEGAL BASIS: art. 6, par. 1, point a) GDPR (consent). RETENTION CRITERIA: until consent is revoked.
Technical cookies
Technical cookies strictly necessary for the functioning of the Site (session, language preferences, security) are exempt from consent pursuant to art. 122 Privacy Code (see §6).
4 · Provision of data
The provision of data for contractual and pre-contractual purposes is necessary for the conclusion of the contract: failure, partial or incorrect provision of such data makes it impossible to conclude the same and process the User's requests (for forms, failure to provide the mandatory fields makes it impossible to process the request).
The provision of data for direct marketing purposes, sending of commercial communications and newsletters is optional and failure to provide it does not preclude the contract and/or the activities connected to the contract.
5 · Recipients of the data and external data processors
Pursuant to art. 4, point 9), GDPR, personal data may be communicated, limited to what is necessary for the respective activities, to the following categories of recipients, who the Data Controller appoints, where the conditions are met, as Data Processors pursuant to art. 28 GDPR and/or authorizes processing:
hosting and technical infrastructure providers;
companies that provide marketing, media buying and data analytics services;
providers of LMS and videoconferencing platforms for the provision of the Services;
payment processing providers, banking institutions and finance companies;
companies or professional firms that provide assistance, consultancy or collaboration in accounting, administrative, fiscal, legal, tax and financial matters (each independent Data Controller or Data Processor depending on the role);
competent authorities, where required under applicable laws, for example in the event of fraudulent activity, abuse or legal proceedings;
third parties who operate in the interest and on behalf of the Supplier for the acquisition of images, audio and video recordings;
internal staff and collaborators of the Data Controller, duly authorized for processing and committed to confidentiality or recipients of an adequate legal obligation of confidentiality.
Main appointed data processors
The Data Controller uses in particular the following suppliers, each regulated by Data Processing Agreement (DPA):
Service: hosting of the Next.js application + aggregated, anonymous and cookieless analytics (see §3, statistical purposes).
Data location: European Union (Frankfurt + Ireland).
Legal basis for transfers: contract + Standard Contractual Clauses where applicable.
DPA : https://vercel.com/legal/dpa
Data processed: server logs, anonymous aggregated traffic metrics.
Retention: 30 days for logs.
Service: sending notification emails to Face Harmony DV staff and acknowledgment emails to Users.
Data location: United States (EU-U.S. Data Privacy Framework certified operator).
DPA : https://resend.com/legal/dpa
Data processed: email address + content of the message sent by the form.
Retention: 30 days.
To protect the contact forms on the Site from automated sending (spam, bots, scraping), this Site uses the Cloudflare Turnstile anti-bot service and makes use of the CDN services provided by Cloudflare Germany GmbH (Rosental 7, c/o Mindspace, 80331 München, Germany) as Data Controller pursuant to art. 28 GDPR.
The anti-bot service analyses technical signals of the User's interaction with the page - IP address, TLS fingerprint, User-Agent and site identifier (sitekey) - for the exclusive purpose of distinguishing human traffic from automated traffic. No profiling cookies are installed and no personal identification of the user is made. The CDN (Content Delivery Network) service also accelerates the distribution of the Site's static contents, collecting technical logs at edge level.
Legal basis: legitimate interest of the Data Controller to prevent abuse (art. 6, par. 1, letter f, GDPR).
Data Transfer: Technical signals may be transferred to the United States based on the Data Privacy Framework (Commission Implementing Decision of July 10, 2023) and/or Standard Contractual Clauses.
DPA : https://www.cloudflare.com/cloudflare-customer-dpa/
Retention period: maximum 30 days in aggregate and non-identifiable form for the anti-bot service; approximately 7 days for CDN edge logs.
More information: Cloudflare Privacy Policy (https://www.cloudflare.com/it-it/privacypolicy/) and Turnstile Privacy Addendum (https://www.cloudflare.com/it-it/turnstile-privacy-policy/).
Service: limitation of the frequency of form submissions to prevent abuse (rate-limiting).
Data location: European Union (Frankfurt).
DPA : https://upstash.com/static/trust/dpa.pdf
Data processed: hash of the IP address (non-reversible for identification purposes).
Retention: 24 hours.
An interactive map provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) through the Google Maps Embed service is incorporated into the Contact page of the Site, with possible sub-processing by Google LLC (1600 Amphitheater Parkway, Mountain View, CA 94043, USA).
The map is used to allow the User to locate the Milan office in Corso Magenta 74 and to obtain driving directions.
Data processed by Google: IP address, device identifier, operating and profiling cookies (for example NID, __Secure-*), browser information, any approximate geolocation coordinates.
Legal basis: consent (art. 6, par. 1, letter a) GDPR). The map iframe is blocked until marketingConsent consent is acquired via the Iubenda cookie banner; the user who does not wish such processing can use the "Open in Google Maps" link which does not involve any prior automatic transmission.
Data transfer: data may be transferred to the United States on the basis of the Data Privacy Framework (Commission Implementing Decision of 10 July 2023) or, alternatively, through Standard Contractual Clauses.
Retention period: according to Google's retention policies, generally no longer than 18 months for advertising data, unless you request deletion via "My Activity".
Rights of the data subject: the user can refuse marketing cookies at any time from the cookie banner, block third-party cookies from the browser settings, or deactivate their Google Account from the Google "Activity Control" panel.
More information: Google Privacy Policy (https://policies.google.com/privacy) and Google Maps additional terms (https://www.google.com/help/terms_maps/).
Service: CMP banner (Consent Management Platform), cookie scanner, legal archiving of consents (Consent Solution / CPL).
Data location: European Union (Italy + Germany).
DPA : https://www.iubenda.com/en/help/29856-iubenda-data-processing-agreement
Data processed: choices expressed in the banner, IP address, timestamp, version of the document accepted, preference identifier.
Retention: 5 years (in accordance with the guidelines of the Italian Data Protection Authority regarding cookies).
Service: external B2B forms linked from the Site (homepage, services pages).
Data location: European Union (Spain).
DPA : https://www.typeform.com/help/a/protecting-your-data-with-typeform-360029259552/
Data processed: responses to B2B forms (contact data and qualification).
Retention: according to Typeform policy, unless canceled upon request.
Service: source code management and deployment automation (CI/CD).
Data location: United States (EU-U.S. Data Privacy Framework certified operator).
DPA : https://docs.github.com/en/site-policy/privacy-policies/github-data-protection-agreement
Data processed: NO user data — the repository contains only application source code.
Disclosure: indicated in this Policy for full technical transparency.
Service: official certified email (PEC) of the company.
Data location: European Union (Italy).
DPA: https://www.legalmail.it/dpa
Data processed: PEC messages with institutions, authorities and professional counterparts.
Retention: according to legal obligations applicable to PECs.
Face Harmony DV S.r.l. uses the WhatsApp Business infrastructure, provided by WhatsApp LLC (Meta Platforms group, Inc., 1601 Willow Road, Menlo Park, CA 94025, United States), to manage communication with Users through the following methods of use, all active on the Site:
WhatsApp Chat Widget — conversation opening button present on the Contacts page and in the footer of the Site. When the User clicks the button, he is redirected to the WhatsApp app (or WhatsApp Web) where he can send a message to the Data Controller's official number.
Customer support — management of requests for information, support and post-sales follow-up initiated by the User via the WhatsApp Business channel indicated above.
Direct marketing — occasional sending of commercial communications, offers and promotional follow-ups to Users who have expressly consented to this contact method by filling out the forms on the Site and providing their telephone number. Consent to direct marketing via WhatsApp is collected separately from the consents necessary to process the main request, in accordance with the art. 130 of the Privacy Code and art. 6, par. 1, point a) GDPR.
Details:
Data Location: United States (Meta Platforms, Inc.). Any data transfers in the non-EU space are regulated by Standard Contractual Clauses and by the Data Privacy Framework (Commission Implementing Decision of 10 July 2023).
DPA : https://www.whatsapp.com/legal/business-data-transfer-addendum
Data processed: User's telephone number, content of messages exchanged, delivery and reading metadata, any device identifiers transmitted by the WhatsApp app.
Legal basis for customer support: (b) execution of pre-contractual measures or (f) legitimate interest of the Data Controller in responding to contact requests sent by the User.
Legal basis for direct marketing: (a) explicit consent of the User pursuant to art. 130 Privacy Code.
Retention: according to Meta/WhatsApp policy + cancellation upon request of the User at the contact details indicated in §1. The User can block the Data Controller's number from the WhatsApp app at any time to prevent further communications.
More information: https://www.whatsapp.com/legal/privacy-policy
Service: management of the Data Controller's ordinary email inbox (dv@face-harmony.com) via Microsoft Exchange Online (Microsoft 365 Business). The domain's MX records point to *.mail.protection.outlook.com.
Data location: European Union (Microsoft EU Data Boundary, primary data center in Ireland + Holland).
DPA : https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA
Data processed: email messages received and sent from the Data Controller's ordinary mailbox, including metadata (sender, recipient, subject, timestamp) and contents of the message.
Data Transfer: As part of the Microsoft EU Data Boundary, data remains in European data centers. Any extra-EU transfers are governed by the Standard Contractual Clauses included in the Microsoft DPA + Data Privacy Framework.
Retention: according to the Data Controller's internal policy and applicable legal obligations (generally email retention for the duration of useful correspondence + accounting and civil obligations).
More information: https://www.microsoft.com/it-it/trust-center/privacy
Service: LMS (Learning Management System) platform through which the contents of the Face Harmony DV Academy are provided (reserved area for students, Beauty Class, digital resources, community).
Data processed: registration data and student accounts (name, surname, email), course use data, interactions in the community.
Data location and DPA: according to the supplier's conditions; the detailed verification of the data localization and the DPA is being updated and the outcome is available upon request to the Data Controller (see §1).
More information: please refer to the platform's privacy policy.
Service: videoconferencing platform used for the provision of online consultations and live meetings, where indicated by the Data Controller.
Data processed: account and connection data (name, email, technical data of the session), audio/video streams of the session; any recordings take place only with prior consent (see §3).
Data location: United States. Data transfer: EU-U.S. Data Privacy Framework + Standard Contractual Clauses.
DPA / More information: https://www.zoom.com/en/trust/privacy/
To process payments relating to the Services, the Data Controller uses third-party payment system providers, in particular:
Stripe (Stripe Payments Europe Ltd. / Stripe Inc., United States — EU-U.S. Data Privacy Framework + Standard Contractual Clauses; PCI-DSS compliant);
PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg; any extra-EU transfers according to the supplier's guarantees);
Splittypay (payment in installments: the installment plan is stipulated directly between the customer, SplittyPay and related parties/transferees);
banking institutions for payments by bank transfer.
The data necessary for payment (e.g. card data) are collected and processed directly by the payment provider as independent owner or manager, according to its own information: the Data Controller does not come into possession of the complete data of the User's card.
Residual category and complete list
The Data Controller may also make use of additional suppliers of technical and marketing services (for example: landing page and funnel platforms, booking/scheduling tools, automation and integration tools, email marketing platforms, advertising tools of social platforms), duly appointed as Data Processors where the conditions exist, limited to the purposes indicated in §3.
A complete and updated list of Data Processors can be requested at any time from the Data Controller at the contact details indicated in §1.
The transfer of personal data to the Managers occurs limited to the performance of specific processing activities linked to the functioning of the Site and/or connected platforms and/or social channels and company functions, and with reference to the completion of procedures relating to the purchase of Services and marketing activities.
6 · Cookies
The Site uses:
Technical cookies strictly necessary for operation (session, language preferences, security). They do not require consent pursuant to art. 122 Privacy Code.
Cookieless analytics (see §3, statistical purposes): aggregate and anonymous metrics collected without installing cookies - legal basis: legitimate interest, no individual profiling.
NO first-party marketing/profiling cookies currently active.
Third-party cookies (Google Maps embed, any Typeform embed): blocked until consent is obtained via cookie banner managed by Iubenda.
For complete details of the cookies used, their duration and purpose, consult the Cookie Policy managed through Iubenda. The connected platforms and external properties (e.g. LMS platform, landing page) manage their own banners and cookie information, to which reference is made.
To change your cookie preferences at any time, use the "Manage cookie preferences" button in the footer of each page of the Site.
7 · Storage period
Personal data are retained for the time strictly necessary to pursue the purposes for which they were collected, according to the retention criteria indicated for each purpose in §3 and the technical retentions of the individual Managers indicated in §5.
In summary: the data processed on a contractual basis are kept for the time necessary to meet the obligations undertaken; the data processed on the basis of consent are retained until revoked (with the maximum limits indicated in §3, e.g. 24 months for marketing, 12 months for profiling, webinars and demonstration purposes); the data processed on the basis of legitimate interest are retained until the data subject objects or the pursued interest is satisfied; data subject to legal obligations are kept for the period established by the applicable law (e.g. 10 years for tax and accounting documents pursuant to art. 2220 of the civil code).
At the end of the periods indicated, the data will be irreversibly deleted or anonymized, unless otherwise required by law or the need to establish, exercise or defend a right in court.
8 · Rights of the data subject (GDPR Articles 15-22)
In relation to the processing described in this Policy, the data subject may exercise the rights listed in this section referred to in articles 15 to 22 GDPR EU Reg. 2016/679, free of charge, unless the requests are manifestly unfounded or excessive, in particular due to their repetitive nature, in which case the Data Controller may charge a reasonable fee.
8.1 Right of access (art. 15, paragraph 1 GDPR)
The data subject has the right at any time to obtain confirmation from the Data Controller as to whether or not his or her personal data is being processed and, in this case, to obtain access to such personal data and the following information: purpose of the processing; categories of personal data processed; recipients or categories of recipients to whom the personal data have been or will be communicated; retention period, if possible, or the criteria used to determine this period; the right of the data subject to ask the Data Controller to rectify or cancel or limit the processing of personal data and the right to object to their processing; the right to lodge a complaint with a Supervisory Authority; if the data are not collected from the data subject, information on their origin; the existence of an automated decision-making process, including profiling pursuant to art. 22, paragraphs 1 and 4 GDPR, and significant information on the logic used, the importance and the expected consequences for the data subject. The information cited above is already present in this privacy policy.
8.2 Right to rectification (Art. 16 GDPR)
The data subject may request the rectification of his/her inaccurate personal data and request integration if they are incomplete, taking into account the purposes of the processing.
8.3 Right to erasure (Art. 17, paragraph 1 GDPR)
The data subject may request the deletion of his personal data, which must take place without unjustified delay; the Data Controller has the obligation to delete the personal data subject to the request if even just one of the following reasons exists: the personal data are no longer necessary with respect to the purposes for which they were collected or otherwise processed; the data subject has revoked the consent on which the processing is based and there is no other legal basis for the related processing; the data subject has objected to the processing pursuant to art. 21, paragraph 1 or 2 GDPR and there is no longer any overriding legitimate reason for processing the personal data; the personal data have been processed unlawfully; it is necessary to delete personal data to comply with a legal obligation established by a European regulation or national law.
Pursuant to art. 17, paragraph 3 GDPR, the Data Controller is entitled not to proceed with the cancellation if the processing of said data is necessary, for example for the exercise of the right to freedom of expression and information, for the fulfillment of a legal obligation, for reasons of public interest, for archiving purposes in the public interest, for scientific or historical research or for statistical purposes, for the assessment, exercise or defense of a right in court.
8.4 Right to restriction of processing (Art. 18 GDPR)
The data subject may obtain the limitation of processing when: he disputes the accuracy of the personal data (in this case the limitation will continue for the time necessary for the Data Controller to verify the accuracy of the data); the processing is unlawful but the data subject opposes the cancellation and instead requests that its use be limited; the personal data are necessary for the data subject to ascertain, exercise or defend his rights in court; the data subject has objected to the processing pursuant to art. 21, paragraph 1 GDPR and is awaiting verification regarding the possible prevalence of the legitimate reasons of the Data Controller with respect to those of the data subject.
In case of limitation of the Processing, the personal data of the data subject will be processed, except for storage, only with your consent or for the establishment, exercise or defense of a right in court or to protect the rights of another natural or legal person or for reasons of significant public interest.
8.5 Right to data portability (art. 20, paragraph 1 GDPR)
The right to data portability provides that the data subject may request to receive his personal data processed by the Data Controller in a structured format, commonly used and readable by an automatic device, if the processing is based on consent or a contract and is carried out by automated means. The data subject may also ask the Data Controller to transmit such data to another data controller without impediments. In the latter case, it will be the responsibility of the data subject to provide the exact information of the new data controller to whom he intends to transfer the Personal Data, providing written authorization.
8.6 Right to object (art. 21, paragraph 2 GDPR and Recital 70)
In the event that the personal data of the data subject are processed for direct marketing purposes, including profiling connected to direct marketing, the data subjects may object to the processing at any time, free of charge and without providing any reason. If Users object to the processing for direct marketing purposes, the Personal Data is no longer processed for these purposes and the processing ceases.
8.7 Right to lodge a complaint with the Supervisory Authority
The data subject may lodge a complaint with the Italian Data Protection Authority if he believes that there has been a violation of his personal data pursuant to the GDPR, without prejudice to the right to appeal to any other competent administrative or jurisdictional body.
8.8 Withdrawal of consent
If the data subject has given consent to the processing of his personal data for one or more purposes, he may revoke it at any time, in whole or in part, without prejudice to the lawfulness of the processing based on the consent given before the revocation. Users have the right to obtain information regarding the legal basis for the transfer of Data abroad, including to any international organization regulated by international law or constituted by two or more countries, as well as regarding the security measures adopted by the Data Controller to protect their personal data.
8.9 How to exercise your rights
The data subject may exercise his rights at any time by sending an email to the address of the Data Controller indicated in the epigraph dv@face-harmony.com or by registered letter to the registered office of the Data Controller.
The Data Controller provides the data subject with information relating to the action taken regarding a request pursuant to articles 15 to 22 without unjustified delay and, in any case, at the latest within one month of receipt of the request itself. This deadline may be extended by two months if necessary, taking into account the complexity and number of requests. The Data Controller informs the data subject of this extension, and of the reasons for the delay, within one month of receiving the request. If the data subject submits the request by electronic means, the information is provided, where possible, by electronic means, unless otherwise indicated by the data subject.
9 · Data transfers outside the EU
Some providers may involve the transfer of personal data outside the European Economic Area, in particular to the United States. In all cases, the Data Controller adopts adequate guarantees pursuant to Chapter V GDPR:
Resend Inc. (United States): EU-U.S. Data Privacy Framework + Standard Contractual Clauses Module 2.
GitHub Inc. (United States): EU-U.S. Data Privacy Framework + Standard Contractual Clauses.
Cloudflare Inc. (global edge, possible US transfer): EU-U.S. Data Privacy Framework + Standard Contractual Clauses.
Google Ireland Ltd. / Google LLC (possible US transfer): EU-U.S. Data Privacy Framework + Standard Contractual Clauses.
WhatsApp LLC / Meta Platforms, Inc. (United States): EU-U.S. Data Privacy Framework + Standard Contractual Clauses.
Zoom Communications, Inc. (United States): EU-U.S. Data Privacy Framework + Standard Contractual Clauses.
Stripe (possible US transfer): EU-U.S. Data Privacy Framework + Standard Contractual Clauses.
PayPal (EU entity; any non-EU transfers according to supplier guarantees, including Standard Contractual Clauses).
LMS platform (Ulama): data localization is being verified in detail; any extra-EU transfers still take place with the guarantees of Chapter V GDPR (adequacy decisions or Standard Contractual Clauses).
The other vendors listed in §5 operate within the European Union.
Any transfers to the United Kingdom are based on the Adequacy Decision - Commission Implementing Decision (EU) 2021/1773 of the Commission of 28 June 2021. For EU-US transfers the regulatory reference is the Data Privacy Framework - Commission Implementing Decision of 10 July 2023 pursuant to Regulation (EU) 2016/679.
10 · Security
The Data Controller adopts adequate technical and organizational measures to guarantee a level of security appropriate to the risk, pursuant to art. 32 GDPR. In particular:
TLS 1.3 enforced throughout the site (HTTPS mandatory, no HTTP fallback).
Anti-bot form protection on all submissions.
Submission rate-limiting system (IP hash, 24h retention) to prevent abuse.
HTTP security headers: Content-Security-Policy (CSP), HTTP Strict Transport Security (HSTS), X-Frame-Options, Referrer-Policy, Permissions-Policy.
Vendors selected on the basis of certifications and industry standards (ISO 27001, SOC 2, EU-U.S. Data Privacy Framework, etc.).
Internal access limited only to those authorized to process data, subject to confidentiality obligations.
Regular updates of the Site's software dependencies to apply security patches.
Continuous monitoring of anomalies and unauthorized access attempts.
11 · Complaints and contacts
The data subject who believes that the processing of personal data relating to him is carried out in violation of the provisions of the GDPR has the right to lodge a complaint with the Italian Data Protection Authority, as provided for by the art. 77 GDPR, or to take action in the appropriate judicial offices pursuant to art. 79 GDPR.
Contacts of the Guarantor Authority:
Website: https://www.garanteprivacy.it/
Headquarters: Piazza Venezia 11, 00187 Rome, Italy
Email: protocollo@gpdp.it
Certified email (PEC): protocollo@pec.gpdp.it
Switchboard: (+39) 06.696771
Alternatively, it is always possible to contact the Data Controller directly at the contact details indicated in §1 for any request, clarification or exercise of your rights. The Data Controller undertakes to respond to each request as quickly as possible and, in any case, within the terms set out in the art. 12 GDPR (within one month, extendable by two months in case of particularly complex requests).
Preferential contact channels:
Ordinary email: dv@face-harmony.com (for requests to exercise rights, clarifications, general contacts)
PEC: faceharmonydv@legalmail.it (for formal and legal communications)
Registered mail with return receipt: addressed to the registered office Corso Magenta 74, 20123 Milan (MI)
12 · Changes to this Policy
The Data Controller reserves the right to make changes to this Privacy Policy at any time; the changes will be made known to Users via the Site. Please therefore consult this page frequently, referring to the date of last modification indicated in the epigraph. If the changes affect processing whose legal basis is consent, the Data Controller will collect the User's consent again, if necessary.
13 · Privacy Policy — Processing of Images and Data in the Face Harmony DV App
This section is drawn up pursuant to EU Regulation 2016/679 (GDPR) and describes the methods of processing of personal data, including images and biometric data, when using the Face Harmony DV App.
13.1 Data controller. The Data Controller is Face Harmony DV S.r.l., with registered office in Corso Magenta 74, 20123 Milan (MI), Italy, email: dv@face-harmony.com.
13.2 Purpose of the processing and nature of the data. The Face Harmony DV App is reserved for professionals in the beauty sector who have completed the training course in the Face Harmony DV Academy. The App allows the acquisition and analysis of images of the face and body using proprietary algorithms for morphological and skin simulation and evaluation. The purposes of the processing are exclusively informative, illustrative and to support professional aesthetic consultancy. The App does not provide medical diagnoses, clinical treatments or guarantee aesthetic results.
13.3 Types of data processed. The App deals with:
facial images (forehead and profile);
biometric data deduced from automated analysis (symmetries, proportions, skin imperfections);
technical metadata (timestamp, session ID, technical processing parameters).
No identifying data (e.g. name, email, tax code) of the end customer is collected.
13.4 Legal basis of processing. The processing of biometric data takes place exclusively with the explicit and informed consent of the end customer, pursuant to art. 9, par. 2, point a) of the GDPR.
13.5 Integration with external suppliers and data localization. To perform visual analysis, the App integrates with the "Skin Analyzer" API service provided by the Third-party provider, appointed external data controller pursuant to art. 28 GDPR. The data is processed via Google Firebase (Ireland) cloud infrastructure, with AES-256 encrypted temporary storage, in compliance with the GDPR.
13.6 Data retention. The processed data are kept for the time strictly necessary to carry out the analysis:
processing in real time or within 60 seconds;
possible temporary storage, no longer than 72 hours, on EU servers (Firebase);
the data are automatically deleted unless otherwise instructed by the Data Controller.
13.7 Security of processing. The App adopts appropriate technical and organizational measures:
HTTPS/TLS 1.2 secure transmission;
encryption of stored data (AES-256);
restricted and profiled access to computing resources;
no manual access to data by the supplier;
no transmission to non-EU countries without adequate guarantees.
13.8 Responsibilities of the professional. The professional is solely responsible for the acquisition, possible saving and management of client images on his/her device. Must:
collect the client's informed consent before analysis;
adopt security measures (e.g. device protection, non-sharing);
delete images at the end of use, unless you agree to their retention;
do not share data with third parties without authorization.
13.9 Rights of the data subject. Pursuant to articles 15-22 of the GDPR, the data subject (end customer) has the right to: be informed about the purposes and methods of the processing; obtain confirmation of the existence of data and access it; request rectification or cancellation; withdraw consent at any time; lodge a complaint with the Guarantor Authority (www.garanteprivacy.it).
13.10 Changes. Face Harmony DV S.r.l. reserves the right to update this section at any time. In case of substantial changes, users will be adequately notified via official channels.
13.11 Contacts. For any request you can write to: Email: dv@face-harmony.com — Address: Corso Magenta 74, 20123 Milan (MI), Italy.
DISCLAIMER — Simulation for illustrative, non-diagnostic purposes: the results do not guarantee real aesthetic effects.
Reference document
This Policy is the reference privacy document of Face Harmony DV S.r.l. and covers the processing carried out via the Site, the Face Harmony DV App, the connected platforms and the Data Controller's social channels (see §1). The external pages and properties managed by the Data Controller refer to this Policy.
The Site's Cookie Policy is managed via the Iubenda platform. In the event of any discrepancy between this Policy and other versions, extracts or summaries published elsewhere, this Policy prevails.
The previous version of this Policy is available upon request to the Data Controller at the contact details indicated in §1.